refactor(frontend): #12363 Phase 1 — last 2 clients onto canonical ApiClient #12582

Context

Discrete sub-issue for Phase 1 of #12363 (single-transport guarantee for the frontend HTTP clients). A prior effort (#12152) already routed 6 of 8 clients through the canonical `utils/ApiClient.ts`. This phase finishes the transport half by migrating the last 2 outliers.

Scope (behaviour-neutral)

• `utils/AdvancedControlApiClient.ts` — swap `fetchWithAuth` for `apiClient.rawRequest` (single-shot; no retry/401-auto-logout change), mirroring the `VisionMultimodalApiClient`/`FeatureFlagsApiClient` thin-wrapper pattern.
• `utils/SecretsApiClient.js` (+ `.d.ts`) — convert to a single typed `SecretsApiClient.ts`, identical behaviour and import surface.

Out of scope (later phases of #12363)

• Phase 2: raw-fetch retirement
• Phase 3: generated-type adoption
• Owner decision: whether AdvancedControl/Secrets should inherit retry + 401-auto-logout (would be a behaviour change).

Refs #12363